@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/runner-deps.d.ts

@@ -204,12 +204,11 @@ export interface RunnerDeps {
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
-     * The deployment's built-in deny-table TIER selection — the ON/OFF switch for the whole built-in
-     * table, OFF unless this seat says otherwise. EXACTLY the listed tiers of
-     * {@link import("../tools/fs/read-deny.js").READ_FACE_BUILTIN_DENY_TABLE} are active (`[]` = none —
-     * explicit and legal); ABSENT = {@link import("../tools/fs/read-deny.js").READ_DENY_DEFAULT_TIERS},
-     * which is EMPTY: an unconfigured deployment activates no built-in row, so nothing from that table
-     * refuses a read or demotes a shell one. A leg's active tiers are REPORTED on its wiring manifest
+     * The deployment's built-in deny-table TIER selection — the switch for the built-in table. EXACTLY the
+     * listed tiers of {@link import("../tools/fs/read-deny.js").READ_FACE_BUILTIN_DENY_TABLE} are active (`[]` =
+     * none — explicit and legal: nothing from that table refuses a read); ABSENT =
+     * {@link import("../tools/fs/read-deny.js").READ_DENY_DEFAULT_TIERS} (`credentials` and the home-anchored
+     * `agent-config`). A leg's active tiers are REPORTED on its wiring manifest
      * ({@link import("./wiring-manifest.js").WiringManifest.readDeny}). Composes with
      * {@link readDenyBuiltinExclude} (tiers first, then row removal); never touches the additions
      * seats or the write faces. Unknown tier names refuse loudly at prepare (#123). DEPLOYMENT seat
@@ -633,9 +632,9 @@ export interface RunnerDeps {
      * `autoMode` (the per-principal deny bit of the user-enabled auto mode), `allowMemoryOptOut` (may this
      * principal declare a capture opt-out), and `forceDurableGate` (forces a run onto the durable-approval
      * path so a policy `ask` suspends to the wire — where a checkpoint store is wired; a store-less leg
-     * announces `config.durable_gate_unavailable`). `allowUltracode` is a shell/UX concern (reasoning-tier,
-     * not a core primitive); `allowBypassPermissions` is enforced at the service settings-resolution layer
-     * (the engine sees only a resolved policy, never a "this allow came from bypass" signal).
+     * announces `config.durable_gate_unavailable`), and `bypassPermissions` (the deny bit of the
+     * `bypassPermissions` mode — a denied request folds to `default`, announced). `allowUltracode` is a shell/UX
+     * concern (reasoning-tier, not a core primitive).
      */
     runtimeCapsResolver?: (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
     /**
@@ -705,7 +704,7 @@ export interface RunnerDeps {
     /**
      * design/143 批2b — the auto-mode classifier's DEPLOYMENT assembly face. This is the
      * CAPABILITY arm of the three-arm arming: a run arms auto mode only when the task carries the
-     * auto-mode INTENT ({@link TaskSpec.autoModeRequested}, or the same bit inherited on the chain by an
+     * auto-mode INTENT (`TaskSpec.permissionMode: "auto"`, or the mode inherited on the chain by an
      * engine-spawned child) AND this face is present AND the per-principal DENY bit is not set
      * ({@link RuntimeCaps.autoMode}` !== false` — absent is not a denial).
      *
@@ -717,6 +716,14 @@ export interface RunnerDeps {
      * `summarize → default`; tier default `flash`) via the brain's simple-completion pipe — same
      * lane as compaction/consolidation, no tools, no session writes.
      */
+    /**
+     * The deployment's A2A peer switches. `isolatePeers: true` makes every A2A peer skill's egress default an
+     * OPERATOR mandate: its ask is `operator_forced` (kept under `bypassPermissions`, not settled by `dontAsk`)
+     * instead of the releasable `tool_marks_a2a`. Absent ⇒ the default (a permission mode may release it, disclosed).
+     */
+    a2a?: {
+        isolatePeers?: true;
+    };
     autoMode?: {
         /** Rule overrides for the four permissions sections (omitted section = CC defaults verbatim). */
         rules?: import("./auto-mode-prompt.js").AutoModeRules;
@@ -726,9 +733,15 @@ export interface RunnerDeps {
         sessionContext?: readonly string[];
         /** Transcript-window bounds for the classify prompt (defaults: 40 entries / 2000 chars each). */
         window?: import("./auto-mode-prompt.js").AutoModeWindowOptions;
-        /** Classify round-trip cap, ms (default 15_000) — ONE ladder rung (see `classifierFallback`), not the
-         *  whole classification. A rung past the cap did not rule: the walk moves to the next candidate, and with
-         *  none left the call is DENIED with a sentence that says so. The next call is classified afresh. */
+        /** Classify round-trip cap, ms — ONE ladder rung (see `classifierFallback`), not the whole classification;
+         *  default `AUTO_MODE_DEFAULT_TIMEOUT_MS` (180 000, sized for a self-hosted gateway's queue + prefill; worst
+         *  case two rungs = 360 s). A rung past the cap did not rule: the walk moves to the next candidate; with none
+         *  left the classification is `unavailable` — the call goes on to a person where the leg has an approval seat
+         *  (a live approver or a durable park), and is DENIED with a sentence that says so where it has none; the
+         *  user hears it either way (`classifier.unavailable`). The next call is classified afresh. A present value
+         *  that is not a number of milliseconds in [1, 2147483647] is REFUSED loudly at every leg's prepare while this face
+         *  is present, whatever mode the leg starts in (`config.auto_mode_timeout_invalid`) — never clamped, never read as the
+         *  default; there is no OFF. */
         timeoutMs?: number;
         /**
          * What a classification does when the classifier SEAT does not rule (the leg threw / rejected, the cap
@@ -744,8 +757,8 @@ export interface RunnerDeps {
          * (worst case two `timeoutMs` caps); `"none"` buys that back for the deny.
          *
          * A value outside the closed set ({@link import("./auto-mode.js").AUTO_MODE_CLASSIFIER_FALLBACKS}) is
-         * REFUSED loudly at prepare (`config.auto_mode_classifier_fallback_invalid`) — never clamped, never read
-         * as the default.
+         * REFUSED loudly at every leg's prepare while this face is present, whatever mode the leg starts in
+         * (`config.auto_mode_classifier_fallback_invalid`) — never clamped, never read as the default.
          */
         classifierFallback?: import("./auto-mode.js").AutoModeClassifierFallback;
         /**
@@ -764,8 +777,9 @@ export interface RunnerDeps {
          * the run STOPS with `TaskResult.errorCode = "classifier.denial_limit"` (a notice of the same
          * code is minted).
          *
-         * Every member optional (defaults 3 / 20 / 120_000). A present member with a bad value is refused
-         * loudly at prepare — never clamped, never silently read as the default.
+         * Every member optional (defaults 3 / 20 / 120_000). A present member with a bad value, a member that is
+         * not one of the three, or a value that is not a record, is refused loudly at every leg's prepare while this face is present, whatever mode the
+         * leg starts in (`config.auto_mode_denial_limit_invalid`) — never clamped, never silently read as the default.
          * See {@link import("./auto-mode.js").AutoModeDenialLimitOptions}.
          */
         denialLimit?: import("./auto-mode.js").AutoModeDenialLimitOptions;
@@ -1354,23 +1368,6 @@ export interface RunnerDeps {
      * deployment wires the factory.
      */
     executionEnvFactory?: import("./remote-env.js").ExecutionEnvFactory;
-    /**
-     * design/77 §1 Gate-1 (oracleIsolation) — a **DISTINCT** trusted control-plane factory that mints the
-     * ISOLATED grader env an out-of-process oracle grades in (the 4th auto-promote gate). It is a SIBLING of
-     * {@link executionEnvFactory}, never the same env: the worker runs in `executionEnvFactory`'s env, the
-     * grader in `graderEnvFactory`'s — so a worker can't corrupt the env that judges it. It inherits the exact
-     * same trust contract: `TaskSpec` deliberately has NO env field (design/44 §7 Q4), so an untrusted caller
-     * can never inject/swap a grader env and grade itself; only the trusted deployment wires this factory. The
-     * RESERVED SEAM, stated plainly (ruled 2026-08-04, field-liveness review): the engine has NO call
-     * site for this factory today — nothing mints, wraps, or asserts through it yet. The intended wirer
-     * is the hardened-grader path a deployment builds on its remote-env side (the k8s pod-spec-patch
-     * seam is the documented server-side half); when that live runner lands, the env it mints is to be
-     * wrapped in a {@link import("./oracle-isolation.js").GraderEnv} and asserted via
-     * {@link import("./oracle-isolation.js").assertOracleIsolation} before any positive oracle verdict.
-     * **Auto-promote stays mandate-OFF until the four gates are implemented + verified end-to-end** (design/77
-     * §7); this seam only makes auto-accept implementable — it does not turn it on.
-     */
-    graderEnvFactory?: import("./remote-env.js").ExecutionEnvFactory;
     /**
      * Containment root for the file tools (design/44 §4 invariant 7): every path must resolve within it,
      * else the tool rejects (`PathNotInRoot`). Default `process.cwd()`. A defense-in-depth guard rail at the

package/dist/core/runtime-caps.d.ts

@@ -81,8 +81,8 @@ export interface WorkflowGovernanceBaseline {
  *  · GRANT-shaped, `=== true` opts in / absent is OFF: {@link allowObservers};
  *  · FORCE-shaped, `true` mandates / absent is the caller's opt-in default: {@link forceDurableGate}
  *    (binds only where a checkpoint store is wired; announced `config.durable_gate_unavailable` where none is).
- * These six are the caps the ENGINE enforces; `allowUltracode`/`allowBypassPermissions` are shell-UX /
- * service-settings-layer concerns (see {@link RunnerDeps.runtimeCapsResolver}).
+ * These seven are the caps the ENGINE enforces — {@link bypassPermissions} is the seventh, the deny bit of the
+ * `bypassPermissions` mode; `allowUltracode` stays a shell-UX concern (see {@link RunnerDeps.runtimeCapsResolver}).
  */
 /**
  * #692 C-d — WHICH plane's ratchet denied auto mode, when the resolver knows: the three settings sources
@@ -135,7 +135,7 @@ export interface RuntimeCaps {
     /**
      * The per-principal auto-mode DENY bit (CC 2.1.250 polarity — the mirror of the settings-plane
      * `permissions.disableAutoMode` ratchet: an organization may only take auto mode AWAY; it is the
-     * USER who turns it on, at the task's intent seat {@link TaskSpec.autoModeRequested}).
+     * USER who turns it on, by requesting the mode at {@link TaskSpec.permissionMode}).
      *
      * **POLARITY: `=== false` DENIES; ABSENT IS NOT A DENIAL.** This is the family's deny-shaped
      * member (like {@link allowWorkflows} / {@link allowFork}), NOT a grant-shaped one like
@@ -157,6 +157,15 @@ export interface RuntimeCaps {
      * manifest) — a source named for a denial that did not happen is a marshalling error, never a fact.
      */
     autoModeDenySource?: AutoModeDenySource;
+    /**
+     * The per-principal `bypassPermissions` DENY bit — the engine seat of the settings-plane
+     * `permissions.disableBypassPermissionsMode: "disable"` ratchet. **`=== false` DENIES; ABSENT IS NOT A DENIAL**
+     * (the family's deny shape, like {@link autoMode}). A task that requests `bypassPermissions` on a leg whose
+     * caps carry `false` runs in `default` instead, announced once (`config.permission_mode_unavailable`,
+     * `by: "operator_deny"`) and reported on `wiring_manifest.permissionMode` — a mode declaration is folded, never
+     * a 4xx. A steer into `bypassPermissions` on such a leg folds the same way.
+     */
+    bypassPermissions?: boolean;
     /**
      * design/383 §3.1 — may this principal declare a session memory-capture OPT-OUT
      * (`TaskSpec.memory.capture: "off"` / the Runner flip verb)? `false` = the deployment REQUIRES

package/dist/core/safety-axis-vocab.d.ts

@@ -25,8 +25,8 @@ export declare const SAFETY_AXIS_VOCABULARY: {
     readonly safetyAxis: readonly ["egress", "irreversible", "shell"];
     /** `RiskDescriptor.severity` — ToolEmu-style tier (5 = most severe), the inbox triage key (checkpoint-store.ts:85). */
     readonly severity: readonly [1, 2, 3, 4, 5];
-    /** `TaskSpec.shellGate` (declared in core/types.ts) — deployment shell-command gate rank, `off` < `classify` < `always`. */
-    readonly shellGate: readonly ["off", "classify", "always"];
+    /** `TaskSpec.shellGate` (declared in core/types.ts) — the operator's shell floor; one value (`always`). */
+    readonly shellGate: readonly ["always"];
     /** `ToolPolicy` decision — per-tool adjudication; `deny` short-circuits the `deny > ask > allow` fold (tool-policy.ts). */
     readonly permissionDecision: readonly ["allow", "ask", "deny"];
 };

package/dist/core/safety-axis-vocab.js

@@ -4,7 +4,7 @@ export const SAFETY_AXIS_VOCABULARY = {
     irreversibility: ["never", "maybe", "always"],
     safetyAxis: ["egress", "irreversible", "shell"],
     severity: [1, 2, 3, 4, 5],
-    shellGate: ["off", "classify", "always"],
+    shellGate: ["always"],
     permissionDecision: ["allow", "ask", "deny"],
 };
 const _toolEffectExhaustive = true;

package/dist/core/secret-env.d.ts

@@ -1,77 +1,50 @@
 /**
- * Canonical "local-spawn shell secret-env protection" (sema D1) — FIRST-PARTY, vendor-independent.
+ * The environment a spawned child inherits: which of this process's variables it must not see.
  *
- * When the engine (or a downstream host/exec adapter) spawns a local shell whose commands the MODEL chooses (no human at the keyboard), the child's
- * inherited env MUST be fail-closed: a model-chosen `printenv DEEPSEEK_API_KEY` via the `bash` tool would
- * otherwise exfiltrate the orchestrator's brain key / git token / DB creds (the gate authorizes WHICH tool runs,
- * NOT isolation). The `scrub` policy drops secret-pattern keys (keeps PATH/build/locale → low breakage).
- *
- * This lives in `src/core/` — NOT `src/vendor/` — on purpose. It is OUR security invariant (D1 is a first-party
- * edit, not openclaw upstream), shared by the (currently-vendored) {@link NodeExecutionEnv} AND a downstream
- * adapter (service host adapter). Keeping the single source of the secret PATTERN here means:
- *   1. A consumer imports it instead of mirroring a regex that would silently DRIFT when the pattern is extended.
- *   2. The public export points at a STABLE first-party path that SURVIVES the planned de-vendoring refactor —
- *      when NodeExecutionEnv is naturalized out of `src/vendor/`, this module does not move and nothing rebinds.
- *
- * The `inheritEnv` THREE-STATE policy (`"all"` opt-out / `"scrub"` default / `string[]` allowlist) is read ONCE, by
- * {@link inheritedHostEnv}, for every engine spawn site that takes it (the tool shell, a `runSpec` oracle gate). A
- * downstream adapter composes its own child env; only the secret PATTERN is shared with it.
+ * A child the engine spawns may run what the MODEL chose (a tool shell, a gate over model-written code, a language
+ * server). Under the `"scrub"` policy (the default) it inherits every variable but those the judgment below names —
+ * deleted whole, never rewritten; `"all"` and a `string[]` allow list are the caller's explicit alternatives
+ * ({@link inheritedHostEnv}). One judgment per variable ({@link classifySecretEnvEntry}), the first rule that answers:
+ *   1. exempt — git's environment config and the proxy variables, handed on as written ({@link isExemptEnvName});
+ *   2. `exact-name` — a known credential name ({@link CREDENTIAL_ENV_NAMES});
+ *   3. `prefix-rule` — the OpenTelemetry settings ({@link OTEL_ENV_RE});
+ *   4. `namespace-rule` — a credential word as any segment of a name in the engine's own `SEMA_` namespace;
+ *   5. `name-rule` — a credential-shaped name ({@link nameIsCredentialShaped}) off {@link NON_SECRET_ENV_EXACT_NAMES};
+ *   6. `value-rule` — a value that carries a credential ({@link valueCarriesCredential}).
+ * {@link isSecretEnvKey} and {@link scrubSecretEnv} both answer with this one judgment. The exempt families, the
+ * credential names, the name shape and the value predicate follow the reference implementation's subprocess-env scrub
+ * as written, three ways stricter: plural `TOKENS` is a credential word unless a count word touches it, the GitHub
+ * token names are not held back from the name shape, and the name shape always runs.
  */
 import type { RedactionConfidence, RedactionSource } from "./arg-summary.js";
 import { type EngineNotice } from "./engine-notice.js";
-/** One git config entry as git reads it from the environment. A half is undefined when its source lacks it (a member
- *  missing from its index group). */
-interface GitConfigEntry {
-    readonly key?: string;
-    readonly value?: string;
-}
-export declare function readGitConfigParameters(text: string): GitConfigEntry[] | undefined;
-/** Which rule classified a key as secret-shaped — the env arm's `kind` vocabulary. */
-export type SecretEnvFindingKind = "suffix-rule" | "namespace-rule" | "exact-name" | "family-rule";
-/** One env entry the `scrub` policy withheld — dropped, or, for a member of git's config record, handed on holding a
- *  placeholder half: the key (the VALUE is never carried — this record is meant to be loggable), the rule that
- *  classified it, how strong that claim is, and the minting module. */
+/** Which rule withheld an entry. */
+export type SecretEnvFindingKind = "exact-name" | "name-rule" | "namespace-rule" | "prefix-rule" | "value-rule";
+/** One env entry the `"scrub"` policy withheld (deleted): its name — never its value, so the record is loggable —, the
+ *  rule that withheld it, how strong that claim is, and the minting module. */
 export interface SecretEnvFinding {
     key: string;
     kind: SecretEnvFindingKind;
     confidence: RedactionConfidence;
     source: RedactionSource;
 }
-/** What the two exact-name lists say about a name, before any shape rule is consulted. */
-export type ExactEnvNameVerdict = "credential" | "exempt" | "unknown";
-/** The exact-name arm of the classification, taking both lists as arguments. The credential list is read
- *  FIRST: an exemption can never take a name away from it, so a name landing on both lists resolves to the
- *  credential reading — the fail-closed direction (a wrongly-exempted name leaks; a wrongly-dropped one
- *  does not). Module-level export (not part of the package surface): the two real lists are disjoint, so
- *  only a controlled collision can tell this precedence from an inverted one. */
-export declare function classifyExactEnvName(key: string, credentialNames: ReadonlySet<string>, exemptNames: ReadonlySet<string>): ExactEnvNameVerdict;
-/** Is `key` a secret-pattern env var (one the fail-closed `scrub` policy drops before spawning a shell)? Pass the
- *  entry's `value` — and the environment it sits in as `env`, and the child's `platform` — to get exactly the scrub's
- *  answer for that entry: a git config member is judged with its index group, which only the environment holds; without
- *  a value the name alone decides (a `GIT_CONFIG_KEY_<i>` then reads as secret — the name cannot clear itself).
- *  `platform` is as for {@link scrubSecretEnv}. */
-export declare function isSecretEnvKey(key: string, value?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
-/** Drop every secret-pattern key (see {@link isSecretEnvKey}) from an env object — the fail-closed `scrub`
- *  policy. git's indexed record is withheld entry by entry and never renumbered ({@link readGitEnvConfigRecord}): a
- *  withheld entry git reads keeps its names, each holding its half of the placeholder entry `sema.withheld` (key) / an
- *  empty string (value), so `GIT_CONFIG_COUNT` and every other index reach the child as the host wrote them. `findings`
- *  is an OPTIONAL caller-owned collector: pass an array to learn which entries were withheld (by name) and why, read it
- *  back after the call. A finding's name is absent from the result unless it is such a record member, which is present
- *  holding the placeholder half. `platform` is the platform the child runs on — where git reads this environment:
- *  Windows reads env names case-insensitively, so there any spelling of a record member is that member; elsewhere git
- *  looks up the capitalised names only and every other spelling is judged on its own, apart from the record. It defaults
- *  to this process's own platform, the answer for a child spawned on this host; a host whose child runs elsewhere (a
- *  remote or sandboxed execution environment) passes that environment's platform. */
-export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[], platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+/** Does the `"scrub"` policy withhold `key`? With `value`, exactly the answer {@link scrubSecretEnv} gives for that
+ *  entry; without it, the answer for its name alone (the value rule then has nothing to read). */
+export declare function isSecretEnvKey(key: string, value?: string): boolean;
+/** The `"scrub"` policy: `env` without every entry {@link isSecretEnvKey} withholds, the rest as written. `findings` is
+ *  an optional caller-owned collector: each withheld entry is pushed onto it (name, rule, confidence), none of them
+ *  present in the result. `env` itself is not modified. */
+export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;
 /** How much of this process's environment a child spawned on this host inherits — the `inheritEnv` value. */
 export type InheritEnvPolicy = "all" | "scrub" | string[];
 /**
  * The environment a child spawned ON THIS HOST inherits, by an {@link InheritEnvPolicy}: `"scrub"` (and absent) is
- * this process's environment through {@link scrubSecretEnv} for this platform; `"all"` is this process's environment
+ * this process's environment through {@link scrubSecretEnv}; `"all"` is this process's environment
  * verbatim (the explicit opt-out); a `string[]` is exactly the named variables that are set, verbatim — a strict allow
  * list, so a name it leaves out (`PATH` included) is not inherited. `findings` collects what the scrub withheld, and
- * only the `"scrub"` arm adds to it. Any other value reads as `"scrub"`: a spawn site that must refuse a malformed
- * policy asks {@link inheritEnvPolicyProblem} first.
+ * only the `"scrub"` arm adds to it. Any other value reads as `"scrub"`; both spawn sites that take a policy — the
+ * tool shell's `NodeExecutionEnv` (at construction) and the oracle gate (per gate) — refuse a malformed one through
+ * {@link inheritEnvPolicyProblem} before it gets here.
  */
 export declare function inheritedHostEnv(policy: InheritEnvPolicy | undefined, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;
 /** Why `value` is not an {@link InheritEnvPolicy} (absent counts as one — the scrub), or `undefined` when it is. */
@@ -86,4 +59,3 @@ export declare function __resetSecretEnvScrubNoticeAnnouncement(): void;
  * findings array is a no-op.
  */
 export declare function announceSecretEnvScrub(onNotice: ((notice: EngineNotice) => void) | undefined, findings: readonly SecretEnvFinding[]): void;
-export {};